winmd-inspect: disambiguate colliding names with fabricated namespaces

Disambiguate the names two reached declarations would otherwise share, so every
signature spelling resolves to the declaration it names and the generated source
compiles. Builds on the nesting slice, adding the collision tally, the
fabricated namespace containers, and the frontier logic.

The projection is one flat top-level Swift scope, so a name is ambiguous when
two or more of the top-level declarations the closure emits bear it *of any
kind* — a second value type, an interface or delegate, or a runtime class.
Because only a value type can be wrapped, an ambiguous value type is spelled and
emitted fully namespace-qualified under fabricated namespace `enum` containers
(`A.Point`/`B.Point`), while the same-named `protocol` stays bare. Ambiguity is
counted over the *projected* (arity-stripped) name the emission carries and only
over the reached declarations, so an unreachable same-named type never forces a
wrap; the qualification keys off the value type's raw `namespace.name` identity
(so a same-named generic protocol does not borrow it) and confirms the reference
resolves locally (so an external same-named type spells bare). The decode
spelling, the emit nesting, and the collision tally derive from one source on
`Storage`, so they cannot drift.

The per-scope validation reconciles every declaration scope — the top-level
roots and each container's direct children — so members bear distinct labels: a
residual clash faults rather than emitting uncompilable output. Two same-named
top-level protocols fault `ambiguous`; a fabricated namespace container
shadowing an emitted type, or a generic interface/delegate's synthesized
`internal protocol <name>ABI` colliding with a co-emitted type, or a fabricated
container shadowing a signature-referenced frontier type the closure spells but
does not emit, faults `collision`. The `<name>ABI` occupant is counted only when
the *selected* template actually declares it — read off the rendered body, not
assumed from the metadata arity — so a `-I` template that omits the helper does
not fault a spurious collision against a real same-named type. A frontier — a
name the closure spells but
does not emit — is derived once from the emitted-set complement rather than
enumerated per reason: the walk records every spelled reference (a
signature-named type or an interface's named base) as its emitted top-level
spelling paired with the `TypeDef` `Id` it resolves to, and a reference is a
frontier exactly when that `Id` (its outermost encloser's, so a nested `A.Inner`
turns on its root `A`, not on `Inner`) is absent from the emitted set. One rule
then covers every way a name goes unemitted — a runtime class, a GUID-less
shape, a `known`-bridged or layout-rejected value type, a metadata-nested
protocol, a value type under a non-container, and an external reference
(including an
external base the `bases` view names though the local-only `requires` walk does
not). The one frontier set serves both seams: the fabricated-namespace shadow
check faults a fabricated `enum` whose name a frontier reference visible in its
scope bears, keyed per reference to its owner — a root segment is a top-level
`enum` visible as a bare name from any scope, so it shadows a frontier of its
name wherever owned; an inner segment (the `B` of `enum A.enum B` wrapping
`A.B.Point`) is visible only from within its own subtree, so it shadows only a
reference owned by a type whose fabricated enclosing path includes it, where a
bare `B` binds outward to the enclosing `A.B`, not the external type — and
the reached-only ambiguity tally treats it
as a distinct top-level bearer — a reached `A.Point` beside a frontier `B.Point`
(external, layout-rejected, `known`-bridged to the same target, or an inherited
base) wraps and qualifies to `A.Point` rather than spelling a bare `Point` that
captures the frontier's reference. Deriving from the complement, not a name
subtraction, keeps a top-level frontier `A` reserved even when an unrelated
nested `Foo.A` is emitted, and reading the `known` bridge name as the spelling
lets a value type of that target name contend. A post-walk reachability prune
keeps only the declarations reachable from the seeds through emittable nodes,
dropping the orphans a discarded frontier would otherwise leave behind, and the
emit renders each kept body once the reached-only qualification sets are fixed,
so a body is spelled with the same set that folds it into the tree.

Integration tests cover two same-named value types each wrapped in its namespace
`enum`, a value type colliding with a same-named protocol, arity and
same-namespace-arity collisions, a generic type's ABI name colliding with a
metadata type, a fabricated container shadowing an emitted type (at the root and
a level down) and a frontier type (top-level, nested — whose enclosing root it
shadows —, an external interface base, and an external base a fabricated
`enum A` must not un-frontier merely because an unrelated nested `Foo.A` is
emitted), a reached value type wrapping against a frontier of the same name (an
external
referent, a layout-rejected value type, an external base, and a `known` bridge
target each), an unreachable same-named type leaving a reached one bare, an
inner fabricated segment shadowing a bare frontier reference owned by a type in
its subtree (faulting where a root-only check would let uncompilable source
through), and a `-I` template that omits the ABI helper leaving its generic type
uncontended.

The collision fixtures assemble their metadata through `WinMDFixture`, an
in-target `#~` assembler that interns the string and blob heaps and computes the
table ranges, so a fixture declares its rows rather than hand-maintaining the
byte offsets every edit would otherwise re-derive, and a fluent `WinMDBuilder`
facade over it lets a fixture state its interfaces, value types, and members and
assigns the rids, links the member lists, encodes the signatures, and resolves
the references — so a scenario reads in a dozen declarative lines instead of a
hundred of hand-encoded bytes. Several collision fixtures are stated through it.


Six review findings across the identity/visibility seam are resolved here. A
by-value type nested beneath a generic encloser has no valid unqualified
spelling, so rather than render it as an opaque pointer — which would silently
change a by-value struct's ABI layout — the whole containing declaration is
dropped (a by-reference type stays the harmless opaque pointer). The inheritance
edge is resolved by identity, not by name: the `bases` view carries the
InterfaceImpl provenance and the render query resolves the local Id, so an
external base sharing a `TypeName` with a local nested interface spells bare
rather than adopting the local one. A nested base reserves the root of its
qualified spelling (`Outer` of `Outer.IChild`) as its frontier label. The
fabricated-namespace shadow check is rewritten to mirror Swift's own name
lookup — a bare frontier reference resolves outward through its owner's
enclosing scopes to the top level, so a top-level protocol, the fabricated
segment above it, or a sibling container visible through a shared ancestor all
capture it and fault — one rule subsuming the top-level, inner, and sibling
cases. Emittedness is read from whether the selected kind section actually
declared the type (its body differs from the template's type-free skeleton), so
a template carrying only shared boilerplate outside its sections declares
nothing and its type stays an unemitted frontier.

Author: compnerd

Sources/SQLEngineWinMD/Database+SQL.swift

@@ -56,8 +56,10 @@ public import WinMD
 extension WinMD.Storage: SQLEngine.Catalog {
   /// The optional tables the bundled queries reference — tables ECMA-335 lets a
   /// database omit from the tables stream (`TypeSpec` §II.22.39 when nothing is
-  /// generic-instantiated, `NestedClass` §II.22.32 when nothing nests) that a
-  /// bundled view or the closure walk still names. `table(named:)` resolves an
+  /// generic-instantiated, `NestedClass` §II.22.32 when nothing nests,
+  /// `ClassLayout` §II.22.8 when no type declares an explicit layout or packing)
+  /// that a bundled view or the closure walk still names. `table(named:)`
+  /// resolves an
   /// absent one to an empty relation and `relations()` enumerates it, so a
   /// `SELECT … FROM` such a table reads no rows rather than faulting on a
   /// missing relation. Only these are synthesised — not the whole table
@@ -1058,13 +1060,15 @@ extension WinMD.Storage {
   /// undecodable signature, or an unresolvable one.
   package borrowing func decode(return method: Int,
                                  generics: Array<String>? = nil,
-                                 in dialect: Dialect) -> String? {
+                                 in dialect: Dialect,
+                                 qualifying: Set<String> = []) -> String? {
     guard let table = opened("MethodDef") else { return nil }
     let cursor = WinMD.Cursor(copy self, table)
     guard let tuple = cursor[method - 1],
         let row = Row<Metadata.Tables.MethodDef>(tuple),
         let signature = try? row.prototype,
-        let resolver = try? Resolver(of: signature, with: self) else {
+        let resolver = try? Resolver(of: signature, with: self,
+                                     qualifying: qualifying) else {
       return nil
     }
     return signature.returns.decode(generics: generics, with: resolver,
@@ -1087,7 +1091,8 @@ extension WinMD.Storage {
   /// it, so threading it is always safe.
   package borrowing func decode(parameter: Int,
                                  generics: Array<String>? = nil,
-                                 for dialect: Dialect) -> String? {
+                                 for dialect: Dialect,
+                                 qualifying: Set<String> = []) -> String? {
     guard let table = opened("Param") else { return nil }
     let params = WinMD.Cursor(copy self, table)
     guard let param = params[parameter - 1],
@@ -1107,7 +1112,8 @@ extension WinMD.Storage {
     guard position >= 1, position <= signature.parameters.count else {
       return nil
     }
-    guard let resolver = try? Resolver(of: signature, with: self) else {
+    guard let resolver = try? Resolver(of: signature, with: self,
+                                       qualifying: qualifying) else {
       return nil
     }
     let name = param.ordinal(for: "Name").flatMap { try? param.string($0) }
@@ -1126,13 +1132,15 @@ extension WinMD.Storage {
   /// type through it. `nil` mirrors the same undecodable contract — an absent
   /// row, an undecodable signature, or an unresolvable one — so the walk can
   /// treat a malformed field as a frontier.
-  package borrowing func decode(field: Int, in dialect: Dialect) -> String? {
+  package borrowing func decode(field: Int, in dialect: Dialect,
+                                qualifying: Set<String> = []) -> String? {
     guard let table = opened("FieldDef") else { return nil }
     let cursor = WinMD.Cursor(copy self, table)
     guard let tuple = cursor[field - 1],
         let row = Row<Metadata.Tables.FieldDef>(tuple),
         let signature = try? row.declaration,
-        let resolver = try? Resolver(of: signature, with: self) else {
+        let resolver = try? Resolver(of: signature, with: self,
+                                     qualifying: qualifying) else {
       return nil
     }
     return signature.type.decode(with: resolver, dialect: dialect)

Sources/SQLEngineWinMD/Resources/Queries/bases.sql

@@ -1,6 +1,15 @@
 CREATE VIEW bases AS
+-- Each plain base carries the InterfaceImpl provenance the render resolves it
+-- by: `ref` is the base's `Interface_TypeRef` Id (a reference the render follows
+-- through the scope chain), `def` its `Interface_TypeDef` Id (a local definition
+-- named directly). Exactly one is non-NULL per plain arm. The render keys the
+-- inheritance spelling off the resolved *identity* rather than correlating the
+-- name against a separate query — an external base that merely shares a bare
+-- `TypeName` with a local nested interface must not adopt the local one's Id.
 SELECT
   b.TypeName AS base,
+  b.Id AS ref,
+  NULL AS def,
   NULL AS spec
 FROM
   InterfaceImpl i
@@ -10,6 +19,8 @@ WHERE
 UNION
 SELECT
   d.TypeName AS base,
+  NULL AS ref,
+  d.Id AS def,
   NULL AS spec
 FROM
   InterfaceImpl i
@@ -18,19 +29,15 @@ WHERE
   i.Class = :parent
 UNION
 -- A generic base interface is named through a TypeSpec: the InterfaceImpl's
--- Interface coded index tags TypeSpec, which has no TypeName of its own. A
--- generic instantiation (GENERICINST <base> <args…>) resolves to its generic
--- base, whose Id the adapter decodes to the TypeSpec's Base_TypeRef or
--- Base_TypeDef key -- the 1-based Id of the base in its table. So the name
--- reads through a seekable join against the TypeRef and TypeDef base tables,
--- mirroring the `identities` view's two TypeSpec arms without re-evaluating a
--- four-way UNION per InterfaceImpl row. Without these arms the generic base is
--- dropped. The TypeSpec's own Id rides alongside as `spec` (NULL on a plain
--- base): the generic definition's TypeName carries an invalid arity suffix and
--- drops the type arguments, so the render decodes the complete constructed
--- spelling from the TypeSpec signature rather than emitting that TypeName.
+-- Interface coded index tags TypeSpec, which has no TypeName of its own. The
+-- name reads through a seekable join against the TypeRef and TypeDef base
+-- tables, mirroring the `identities` view's two TypeSpec arms. The TypeSpec's
+-- own Id rides alongside as `spec` (NULL on a plain base); the render omits a
+-- generic base (`spec IS NULL`), so its `ref`/`def` are NULL.
 SELECT
   r.TypeName AS base,
+  NULL AS ref,
+  NULL AS def,
   i.Interface_TypeSpec AS spec
 FROM
   InterfaceImpl i
@@ -41,6 +48,8 @@ WHERE
 UNION
 SELECT
   d.TypeName AS base,
+  NULL AS ref,
+  NULL AS def,
   i.Interface_TypeSpec AS spec
 FROM
   InterfaceImpl i